Pass MCP configuration inline via --additional-mcp-config flag using environment variable #14810

Copilot · 2026-02-10T15:50:54Z

Copilot CLI now receives MCP configuration via --additional-mcp-config flag instead of reading from ~/.copilot/mcp-config.json. All configuration remains in memory with no file writes.

Changes

Shell Scripts

convert_gateway_config_copilot.sh: Output compact JSON to stdout (jq -c) instead of writing to file
start_mcp_gateway.sh: Store converted JSON in GH_AW_COPILOT_MCP_CONFIG environment variable and output to GitHub Actions step output using multiline string syntax

Go Code

copilot_engine_execution.go: Set GH_AW_COPILOT_MCP_CONFIG environment variable from step output and pass to copilot via --additional-mcp-config "$(printf %q "$GH_AW_COPILOT_MCP_CONFIG")" with proper quote escaping
Remove GH_AW_MCP_CONFIG environment variable (no longer needed)

Tests

playwright_allowed_domains_secrets_test.go: Update to check MCP gateway input instead of file writes

Compiled Output

Before:

env:
  GH_AW_MCP_CONFIG: /home/runner/.copilot/mcp-config.json
run: |
  mkdir -p /home/runner/.copilot
  cat > /home/runner/.copilot/mcp-config.json << EOF
  {"mcpServers": {...}}
  EOF
  copilot --prompt "..." ...

After:

run: |
  copilot --additional-mcp-config "$(printf %q "$GH_AW_COPILOT_MCP_CONFIG")" --prompt "..." ...
env:
  GH_AW_COPILOT_MCP_CONFIG: ${{ steps.start-mcp-gateway.outputs.copilot-mcp-config }}

Security & Encoding Safety

JSON is compacted via jq -c and stored in environment variable
Step output passed to environment variable prevents template injection vulnerabilities
printf %q properly escapes JSON containing both single quotes (') and double quotes (")
No file writes - configuration is truly in-memory only
No string interpolation or user input in the pipeline

Impact: Copilot engine only. Claude/Codex/Custom engines unchanged.

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Changeset

Type: patch
Description: Pass Copilot's MCP gateway configuration via --additional-mcp-config so the setup stays in memory instead of writing mcp-config.json.

Generated by Changeset Generator

- Modified convert_gateway_config_copilot.sh to output JSON to stdout instead of writing to file - Updated start_mcp_gateway.sh to save converted config to /tmp/gh-aw/mcp-config/copilot-mcp-config.json - Added --additional-mcp-config flag to copilot CLI invocation with inline JSON from file - Removed GH_AW_MCP_CONFIG environment variable as config is now passed inline - Config is no longer written to ~/.copilot/mcp-config.json Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

- Updated playwright_allowed_domains_secrets_test.go to check MCP gateway input instead of mcp-config.json - Recompiled all 148 workflows successfully - All Copilot workflows now use --additional-mcp-config flag instead of writing to ~/.copilot/mcp-config.json - Verified no Copilot workflows have GH_AW_MCP_CONFIG environment variable anymore - All unit tests passing Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

actions/setup/sh/start_mcp_gateway.sh

@pelikhan

Per @pelikhan's feedback, the MCP configuration is now stored as an environment variable instead of writing to a file, making it truly in-memory only. Changes: - start_mcp_gateway.sh: Store JSON in GH_AW_COPILOT_MCP_CONFIG env var and output to step - copilot_engine_execution.go: Use env var GH_AW_COPILOT_MCP_CONFIG from step output - Eliminates intermediate file /tmp/gh-aw/mcp-config/copilot-mcp-config.json - Uses GitHub Actions multiline string syntax for step output - Passes config via env var to prevent template injection Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-02-10T16:39:15Z

pkg/workflow/copilot_engine_execution.go

+	if hasMCPServers {
+		// The JSON is passed via GH_AW_COPILOT_MCP_CONFIG environment variable
+		// which is set from the step output to prevent template injection
+		copilotArgs = append(copilotArgs, "--additional-mcp-config", "\"$GH_AW_COPILOT_MCP_CONFIG\"")


@copilot you need to add the argument in a way that handles the case where the JSON payload contains quotes " and single quotes '

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-02-10T18:00:19Z

@copilot keep working

The JSON payload in GH_AW_COPILOT_MCP_CONFIG can contain both single and double quotes. Using printf %q ensures the JSON is properly quoted for shell reuse, handling all special characters including quotes. Changes: - Add --additional-mcp-config after base command is built - Use printf %q "$GH_AW_COPILOT_MCP_CONFIG" for safe shell quoting - Works correctly when wrapped in AWF's single quotes via shellEscapeArg - All 148 workflows recompiled with proper quote handling Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-02-10T18:07:18Z

@copilot keep working

Completed in 5e863bc. The --additional-mcp-config flag now uses printf %q to properly escape JSON with quotes:

--additional-mcp-config "$(printf %q "$GH_AW_COPILOT_MCP_CONFIG")"

This handles both single quotes (') and double quotes (") in the JSON payload correctly. The printf %q shell builtin quotes strings in a format that can be safely reused as shell input, properly escaping all special characters.

github-actions · 2026-02-10T18:11:35Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-02-10T18:11:36Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-02-10T18:11:37Z

🧪 Smoke Project is now testing project operations...

github-actions · 2026-02-10T18:11:40Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-02-10T18:11:41Z

✅ Changeset Generator completed successfully!

github-actions · 2026-02-10T18:12:51Z

❌ Smoke Project encountered failures. Check the logs for details.

github-actions · 2026-02-10T18:14:25Z

📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident...

github-actions · 2026-02-10T18:16:04Z

Smoke test (Codex)
Merged PRs: #14817 [docs] Remove bloat from errors.md documentation; #14802 Add disable-agentic-editing frontmatter field to Astro docs
GitHub MCP: ✅
Serena (activate + find_symbol>=3): ✅
Playwright title contains GitHub: ✅
File write + cat: ✅
Build (make build): ✅
Overall: PASS

AI generated by Smoke Codex

Initial plan

8a1c25d

Copilot AI assigned Copilot and pelikhan Feb 10, 2026

Copilot started work on behalf of pelikhan February 10, 2026 15:51 View session

Copilot AI and others added 2 commits February 10, 2026 15:59

Copilot AI changed the title ~~[WIP] Add additional MCP config support for copilot CLI~~ Pass MCP configuration inline via --additional-mcp-config flag Feb 10, 2026

Copilot AI requested a review from pelikhan February 10, 2026 16:09

Copilot finished work on behalf of pelikhan February 10, 2026 16:09

pelikhan reviewed Feb 10, 2026

View reviewed changes

actions/setup/sh/start_mcp_gateway.sh Outdated Show resolved Hide resolved

Copilot started work on behalf of pelikhan February 10, 2026 16:16 View session

Copilot AI changed the title ~~Pass MCP configuration inline via --additional-mcp-config flag~~ Pass MCP configuration inline via --additional-mcp-config flag using environment variable Feb 10, 2026

Copilot AI requested a review from pelikhan February 10, 2026 16:25

Copilot finished work on behalf of pelikhan February 10, 2026 16:25

pelikhan reviewed Feb 10, 2026

View reviewed changes

Copilot started work on behalf of pelikhan February 10, 2026 16:40 View session

Changes before error encountered

236d9ef

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI requested a review from pelikhan February 10, 2026 17:17

Copilot started work on behalf of pelikhan February 10, 2026 18:01 View session

Copilot finished work on behalf of pelikhan February 10, 2026 18:08

pelikhan added the smoke label Feb 10, 2026

Add changeset [skip-ci]

c1adf6c

github-actions bot added smoke-codex and removed smoke labels Feb 10, 2026

github-actions bot mentioned this pull request Feb 10, 2026

Smoke Test: Claude - 21876859538 #14821

Closed

pelikhan closed this Feb 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Pass MCP configuration inline via --additional-mcp-config flag using environment variable #14810

Pass MCP configuration inline via --additional-mcp-config flag using environment variable #14810

Uh oh!

Copilot AI commented Feb 10, 2026 •

edited by github-actions bot

Loading

Uh oh!

Uh oh!

pelikhan Feb 10, 2026

Uh oh!

pelikhan commented Feb 10, 2026

Uh oh!

Copilot AI commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 10, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Pass MCP configuration inline via --additional-mcp-config flag using environment variable #14810

Pass MCP configuration inline via --additional-mcp-config flag using environment variable #14810

Uh oh!

Conversation

Copilot AI commented Feb 10, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Compiled Output

Security & Encoding Safety

Changeset

Uh oh!

Uh oh!

pelikhan Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Feb 10, 2026

Uh oh!

Copilot AI commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Feb 10, 2026 •

edited by github-actions bot

Loading

github-actions bot commented Feb 10, 2026 •

edited

Loading

github-actions bot commented Feb 10, 2026 •

edited

Loading

github-actions bot commented Feb 10, 2026 •

edited

Loading